Subject: RE: [Sip] Re: issue with oubound and the used transport protocol

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Fri, 1 Dec 2006 14:35:21 +0100

Hi, 

>My point was that the keep-alive didn't matter since any 
>option will work, and you don't need one in the first place 
>because the UDP/IPsec already has one.

Exactly.

So, do we really need to specify what other keepalive mechanisms than
STUN can be used then? Can't we simply say that one shall use STUN
unless another mechanism is provided by the transport/security layer?

>But it just occured to me... I'm thinking VPN, and you are 
>probably thinking 3GPP. And I don't know anything about how 
>that works. :-)

I was thinking 3GPP, yes :)

Regards,

Christer

> > -----Original Message-----
> > From: Christer Holmberg (JO/LMF)
> > [mailto:[email-masked]]
> > Sent: Thursday, November 30, 2006 13:49
> > To: Audet, Francois (SC100:3055); Kevin Johns; Fredrik Thulin
> > Cc: [email-masked]; [email-masked]
> > Subject: RE: [Sip] Re: issue with oubound and the used transport 
> > protocol
> > 
> > 
> > Hi,
> > 
> > >I would think that UDP encapsulated IPsec would have it's own 
> > >keep-alive.
> > >So they wouldn't need Outbound in the first place.
> > 
> > They may want to use outbound in order to support multiple 
> simultanous 
> > registrations.
> > 
> > So, if there would also be NATs, the question is what 
> keep-alive they 
> > should use.
> > 
> > Regards,
> > 
> > Christer
> > 
> > 
> > 
> > 
> > > 
> > > But even if they didn't then the CRLF thing would still work.
> > > 
> > > > -----Original Message-----
> > > > From: Kevin Johns [mailto:[email-masked]]
> > > > Sent: Thursday, November 30, 2006 12:47
> > > > To: Fredrik Thulin; Audet, Francois (SC100:3055)
> > > > Cc: [email-masked]; [email-masked]
> > > > Subject: RE: [Sip] Re: issue with oubound and the used 
> transport 
> > > > protocol
> > > > 
> > > > Not all architectures use TLS/TCP, some use UDP
> > encapsulated IPsec.
> > > > Would a TCP session via UDP encapsulated IPsec be impacted
> > > by this? I
> > > > do not think it would, but just wanted to double check...
> > > > 
> > > > Kevin
> > > > 
> > > > -----Original Message-----
> > > > From: Fredrik Thulin [mailto:[email-masked]]
> > > > Sent: Thursday, November 30, 2006 11:21 AM
> > > > To: Francois Audet
> > > > Cc: [email-masked]; [email-masked]
> > > > Subject: Re: [Sip] Re: issue with oubound and the used 
> transport 
> > > > protocol
> > > > 
> > > > Francois Audet wrote:
> > > > > Didn't we agree way back NOT to use PING, CRLF, etc., and
> > > use STUN
> > > > > instead?
> > > > > 
> > > > > Why is this debate being re-opened?
> > > > 
> > > > Because it seems more and more (to me at least) that
> > > Outbound with UDP
> > > > will just suck.
> > > > 
> > > > If Outbound UA's have to get their act together and
> > > implement TLS/TCP,
> > > > then we can simplify Outbound even further by skipping the
> > > whole STUN
> > > > keepalive thing, and go with CRLF over TLS/TCP.
> > > > 
> > > > I am very much in favor of cutting both UDP and STUN
> > > keepalives out of
> > > > Outbound. I think that would lead to faster deployment, and
> > > also make
> > > > the world a better place by eliminating some SIP over UDP.
> > > > 
> > > > /Fredrik
> > > > 
> > > > PS. By the way, when people say CRLF keepalives, do you
> > > mean CRLF sent
> > > > only from the UA, or CRLF from UA to edge proxy followed
> > by CRLF in
> > > > the reverse direction too?
> > > > 
> > > > 
> > > > 
> > > > _______________________________________________
> > > > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > > > This list is for NEW development of the core SIP Protocol Use 
> > > > [email-masked] for questions on 
> current sip Use 
> > > > [email-masked] for new developments on the application of sip
> > > > 
> > > > 
> > > 
> > > _______________________________________________
> > > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > > This list is for NEW development of the core SIP Protocol Use 
> > > [email-masked] for questions on current sip Use 
> > > [email-masked] for new developments on the application of sip
> > > 
> > 
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Fri, 1 Dec 2006 14:54:21 +0100

Hi,

No matter how we do the keep-alive, I think STUN is a good tool for the
UA to figure out whether it's located behind a NAT in the first place,
by checking the XMA value etc. Again, outbound can be used also in
no-NAT scenarios, so the UA can use the STUN response information to
decide whether it needs to send keep-alives in the first place.

Regards,

Christer

---

From: "Francois Audet" <[email-masked]>
Date: Fri, 1 Dec 2006 12:42:02 -0600

I think we are in violent agreement.

I'm not even sure we need to say anything here. Seems to me it's a
3GPP-specific
non-issue... 

> Sent: Friday, December 01, 2006 05:35
> transport protocol
> >My point was that the keep-alive didn't matter since any option will 
> >work, and you don't need one in the first place because the 
> UDP/IPsec 
> >already has one.
> 
> Exactly.
> 
> So, do we really need to specify what other keepalive 
> mechanisms than STUN can be used then? Can't we simply say 
> that one shall use STUN unless another mechanism is provided 
> by the transport/security layer?
> 
> >But it just occured to me... I'm thinking VPN, and you are probably 
> >thinking 3GPP. And I don't know anything about how that works. :-)
>

---

From: <[email-masked]>
Date: Mon, 4 Dec 2006 11:57:51 +0200

Hi,

>UA to figure out whether it's located behind a NAT in the first place

Please remember that UA could figure that out also with rport.
It should work both for UDP and TCP as well.

>decide whether it needs to send keep-alives in the first place.

Generically STUN does not help for that, since keepalives are also
needed due to firewalls and STUN can not help the UA to detect the
presence of firewall.

In my understanding muxing STUN with SIP seemed as a good idea for
UDP flows. However if the value of UDP flows is rather questionable,
I would claim the same applies also to STUN keepalives, too.

Regards,

Erkki

---

From: "Aki Niemi" <[email-masked]>
Date: Mon, 4 Dec 2006 12:26:50 +0200

>No matter how we do the keep-alive, I think STUN is a good 
>tool for the UA to figure out whether it's located behind a 
>NAT in the first place, by checking the XMA value etc. Again, 
>outbound can be used also in no-NAT scenarios, so the UA can 
>use the STUN response information to decide whether it needs 
>to send keep-alives in the first place.

I disagree; that will generally not work.

Many networks deploy stateful firewalls that do connection tracking. They
will not show up as NAT, but will require keepalives. I've seen these
especially in mobile networks, but I would imagine many enterprises deploy
similar stuff.

My experience has been that if you want robust connectivity for your SIP
app, use TCP (you get 30x more performance from middleboxes) and *always*
use keepalives, with their frequency tuned towards the lowest common
keepalive interval found in the field.

Clearly, YMMV.

Cheers,
Aki

---

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Mon, 4 Dec 2006 20:04:04 +0100

Hi Aki,
 
You are correct regarding firewalls. I was only thinking about NATs.
 
Regards,
 
Christer

________________________________

From: Aki Niemi [mailto:[email-masked]]
Sent: Mon 04/12/2006 11:26
To: Christer Holmberg (JO/LMF); 'Francois Audet'; 'Kevin Johns'; 'Fredrik Thulin'
Cc: [email-masked]; [email-masked]
Subject: RE: [Sip] Re: issue with oubound and the used transport protocol-decide whether to send keep-alive in the first place 

Clearly, YMMV.

Cheers,
Aki